World K3: Counters & Doors · Boss challenge

Open the doors

You will learn: to route / and /api through a Gateway with TLS, and lock the database.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

You are here: cluster kind-dev namespace default

~/shop $ kubectl get servicesNAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGEapi          ClusterIP   10.96.100.64    <none>        80/TCP     21sdb           ClusterIP   10.96.184.211   <none>        5432/TCP   21skubernetes   ClusterIP   10.96.0.1       <none>        443/TCP    5m21sshop         ClusterIP   10.96.169.126   <none>        80/TCP     21s~/shop $ kubectl get gatewayNo resources found in default namespace.

Boss: opening night at Kedai Kancil! Customers need / and /api, over HTTPS. The database must stay locked. Five rooms. Go!

Try it

Room 1: Mei copied the /api sign from an old Ingress. It won’t apply. Fix it.

Fix the manifest, then press Apply.

api-route.yaml16 lines

Try it

Room 2: build the entrance and put up the signs. Then knock on /api.

You are here: cluster kind-dev namespace default

api2/2 ready
db1/1 ready
shop3/3 ready

dev-control-planeOpenManager

No trays here.

dev-workerOpen

api·t8fcl
shop·4jjmg
shop·s7gcz

dev-worker2Open

api·czglm
db·jlkfb
shop·dxr6c

Time: +0s (sped up)

Hint

The door is entrance.yaml. The signs are routes.yaml.

Try it

Room 3: on a teammate’s copy, /api answers 503. Find the broken hop and switch it back.

Something is broken. Find it, fix it, then send again.

BrowserGET /api/menu on port 80
Gateway (entrance)entrance listens on :80
HTTPRoute (signboard)/api → api:80
Service (order number)api: port 80 → 8080
EndpointSlice (ready trays)0 ready of 0
Pod (tray)api-6d8f7b9c5d-k2x8p listens on :8080

Break something

Try it

Room 4: lock the order on the way. The certificate Secret kedai-tls is ready. Open the HTTPS door.

You are here: cluster kind-dev namespace default

Entrance entrance 172.18.0.200/ → shop/api → api

api2/2 ready
db1/1 ready
shop3/3 ready

dev-control-planeOpenManager

No trays here.

dev-workerOpen

api·l2nhc
shop·7vjrt
shop·zs7lw

dev-worker2Open

api·6dt9n
db·mqvk2
shop·crjtt

Time: +0s (sped up)

Hint

tls.yaml adds the HTTPS listener to the same entrance.

Check

Your boss asks: “Who renews that certificate in three months?”

Try it

Final room: lock the database. Only the api may call it. Two files are ready: db-deny.yaml and db-lock.yaml. Read them first.

You are here: cluster kind-dev namespace default

Entrance entrance 172.18.0.200/ → shop/api → api

api2/2 ready
db1/1 ready
shop3/3 ready

dev-control-planeOpenManager

No trays here.

dev-workerOpen

api·shnfm
shop·65h4h
shop·vfxd9

dev-worker2Open

api·fbvhc
db·9vvzw
shop·dv2kn

Time: +0s (sped up)

Check

Last question. Why did the shop get a timeout, not an error page?

You did it!

You can now open the doors safely, and lock the database.

Go deeper (optional)

In the practice cluster, the database answers web requests on 5432. So wget can test the lock. A real Postgres speaks its own protocol. Test it with a database client instead.

Real rep (optional): the same rooms on your kind cluster (kind 0.24 or newer):

Real mission

A Gateway with / to your web app and /api to your API.
An HTTPS listener with a certificate from cert-manager.
A NetworkPolicy: only the API may reach the database.
Test from an allowed pod and a blocked pod.

0 of 4 steps done · Your ticks are saved.